[Mr.Monocles]

Recently my computer was infected with Dealz a virus that changed Chrome's settings and locked me out of some stating that administrative permission is needed to alter the settings. After perusing the internet I came across an article that stated that HitmanPro should help with getting rid of the problem if malwarebyes could not. I may have been more aggressive than necessary with the deleting and quarantining of files and that resulted in my Windows installation not being able to start. Startup Repair cannot automatically detect the problem, and despite having a system restore point, it seems that it was somehow rendered useless because windows gives me a message saying that there are no restore points. 

 

I was wondering if there was a way to fix the problem without reinstalling windows entirely. There was a very similar problem discussed here http://www.geekstogo...o-killed-my-os/. I did not however want to follow the same steps exactly lest I worsen the problem.

[Advertisements]

Hi and welcome to Geeks to Go.

Can you inform myself please which exact version of Windows your infected machine has and are you still able to download with it at all(or do you have another machine we can use for downloading and if so what Operating System does that have) ? Plus do you have a USB flash type drive we can make use of ?

Answer the above please then we then go from there, thank you.

[Dakeyras]

Hi and welcome to Geeks to Go.

Can you inform myself please which exact version of Windows your infected machine has and are you still able to download with it at all(or do you have another machine we can use for downloading and if so what Operating System does that have) ? Plus do you have a USB flash type drive we can make use of ?

Answer the above please then we then go from there, thank you.

[Mr.Monocles]

The infected machine has Windows 7 Home Premium 64-bit installed on it. I cannot download with it, seeing as it attempts to start windows then instantly runs startup repair (which fails every time). I however have a laptop (also Windows 7 Home Premium 64-bit) and several USB flash-drives that may be used to aid in the process of correcting the problem.

[Dakeyras]

Hi.

Thank you for the clafication, lets proceed as follows shall we...

Scan with Farbar Recovery Scan Tool:

Please download and save Farbar Recovery Scan Tool 64-Bit to a Flash/USB drive.

Then insert the Flash/USB drive into your problem machine....

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst64.exe and press Enter

Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste the contents of the aforementioned notepad file in your next reply.

[Mr.Monocles]

I have completed the steps you have asked of me and the program gave the following information:

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:16-10-2015

Ran by SYSTEM on MININT-36RV336 (18-10-2015 19:50:31)

Running from f:\

Platform: WIN_7 Service Pack 1 (X64) Language: English (United States)

Boot Mode: Recovery

ATTENTION: Could not load system hive.

ATTENTION: System hive is missing.

 

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

ATTENTION: Software hive is missing.

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

 

==================== Known DLLs (Whitelisted) =========================

 

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe IS MISSING <==== ATTENTION

C:\Windows\System32\wininit.exe IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\wininit.exe IS MISSING <==== ATTENTION

C:\Windows\explorer.exe IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\explorer.exe IS MISSING <==== ATTENTION

C:\Windows\System32\svchost.exe IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\svchost.exe IS MISSING <==== ATTENTION

C:\Windows\System32\services.exe IS MISSING <==== ATTENTION

C:\Windows\System32\User32.dll IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\User32.dll IS MISSING <==== ATTENTION

C:\Windows\System32\userinit.exe IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\userinit.exe IS MISSING <==== ATTENTION

C:\Windows\System32\rpcss.dll IS MISSING <==== ATTENTION

C:\Windows\System32\dnsapi.dll IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\dnsapi.dll IS MISSING <==== ATTENTION

C:\Windows\System32\Drivers\volsnap.sys IS MISSING <==== ATTENTION

C:\Windows\System32\codeintegrity\Bootcat.cache IS MISSING <==== ATTENTION

C:\Windows\System32\winsrv.dll IS MISSING <==== ATTENTION

 

==================== Restore Points =========================

 

 

==================== Memory info =========================== 

 

Percentage of memory in use: 8%

Total physical RAM: 8190.17 MB

Available physical RAM: 7495.94 MB

Total Virtual: 8188.37 MB

Available Virtual: 7476.5 MB

 

==================== Drives ================================

 

Drive d: (Windows) (Fixed) (Total:931.41 GB) (Free:306.02 GB) NTFS

Drive f: (ANGELOS USB) (Removable) (Total:7.59 GB) (Free:4.98 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (System) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from drive)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 32A54498)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 7.6 GB) (Disk ID: C3072E18)

Partition 1: (Not Active) - (Size=7.6 GB) - (Type=0C)

 

==================== End of FRST.txt ============================

 

 

 

 

 

 

I thank you for your assistance even after my late replies.

[Dakeyras]

Hi.

I thank you for your assistance even after my late replies.

Not a problem and you're welcome.

Please reboot your problem machine into the System Recovery Options as you did last time and select the Command Prompt option.

Type in the following command:

chkdsk c: /r

Then depress the press Enter/Return key.

Note: The above may take quite some time to complete.

Upon completion please check if your machine is now able to boot into Normal Mode, if not post a new FRST log for my review as outlined in post #4.

[Mr.Monocles]

Unfortunately the issue still persists despite your last piece of advice. The following is a new farbar scan result:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-10-2015

Ran by SYSTEM on MININT-9GE8D22 (19-10-2015 21:16:21)

Running from f:\

Platform: WIN_7 Service Pack 1 (X64) Language: English (United States)

Boot Mode: Recovery

ATTENTION: Could not load system hive.

ATTENTION: System hive is missing.

 

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

ATTENTION: Software hive is missing.

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

 

==================== Known DLLs (Whitelisted) =========================

 

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe IS MISSING <==== ATTENTION

C:\Windows\System32\wininit.exe IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\wininit.exe IS MISSING <==== ATTENTION

C:\Windows\explorer.exe IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\explorer.exe IS MISSING <==== ATTENTION

C:\Windows\System32\svchost.exe IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\svchost.exe IS MISSING <==== ATTENTION

C:\Windows\System32\services.exe IS MISSING <==== ATTENTION

C:\Windows\System32\User32.dll IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\User32.dll IS MISSING <==== ATTENTION

C:\Windows\System32\userinit.exe IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\userinit.exe IS MISSING <==== ATTENTION

C:\Windows\System32\rpcss.dll IS MISSING <==== ATTENTION

C:\Windows\System32\dnsapi.dll IS MISSING <==== ATTENTION

C:\Windows\SysWOW64\dnsapi.dll IS MISSING <==== ATTENTION

C:\Windows\System32\Drivers\volsnap.sys IS MISSING <==== ATTENTION

C:\Windows\System32\codeintegrity\Bootcat.cache IS MISSING <==== ATTENTION

C:\Windows\System32\winsrv.dll IS MISSING <==== ATTENTION

 

==================== Restore Points =========================

 

 

==================== Memory info =========================== 

 

Percentage of memory in use: 8%

Total physical RAM: 8190.17 MB

Available physical RAM: 7478.78 MB

Total Virtual: 8188.37 MB

Available Virtual: 7462.4 MB

 

==================== Drives ================================

 

Drive d: (Windows) (Fixed) (Total:931.41 GB) (Free:306.02 GB) NTFS

Drive f: (USB20FD) (Removable) (Total:7.59 GB) (Free:7.59 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (System) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from drive)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 32A54498)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 7.6 GB) (Disk ID: C3072E18)

Partition 1: (Not Active) - (Size=7.6 GB) - (Type=0C)

 

==================== End of FRST.txt ============================

[Dakeyras]

Hi.

Unfortunately the issue still persists despite your last piece of advice.

Not looking good I'm afraid and we may have to resort to a actual reformat of the hard-drive and reinstallation of the Windows Operating System.

However there is something further I would like to check out as follows before we consider the aforementioned.

Scan with ListParts:

Please download and save ListParts 64-Bit to a Flash/USB drive.

Then insert the Flash/USB drive into your problem machine....

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\listparts64.exe and press Enter

Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Select the option: List BCD
• Press Scan button.
• It will make a log (Result.txt) on the flash drive. Please copy and paste the contents of the aforementioned notepad file in your next reply.

[Mr.Monocles]

Thank you for your continued assistance. The results of the program are as follows:

 

 

ListParts by Farbar Version: 31-07-2014

Ran by SYSTEM (administrator) on 20-10-2015 at 17:23:13

Windows 7 (X64)

Running From: g:\

Language: English (United States)

************************************************************

 

========================= Memory info ====================== 

 

Percentage of memory in use: 8%

Total physical RAM: 8190.17 MB

Available physical RAM: 7504.75 MB

Total Pagefile: 8188.37 MB

Available Pagefile: 7493.73 MB

Total Virtual: 8192 MB

Available Virtual: 8191.93 MB

 

======================= Partitions =========================

 

1 Drive c: (System) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

2 Drive d: (Windows) (Fixed) (Total:931.41 GB) (Free:306.02 GB) NTFS

5 Drive g: (CRUZER) (Removable) (Total:3.74 GB) (Free:3.52 GB) FAT32

6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

 

  Disk ###  Status         Size     Free     Dyn  Gpt

  --------  -------------  -------  -------  ---  ---

  Disk 0    Online          931 GB      0 B         

  Disk 1    Online         3835 MB      0 B         

 

Partitions of Disk 0:

===============

 

Disk ID: 32A54498

 

  Partition ###  Type              Size     Offset

  -------------  ----------------  -------  -------

  Partition 1    Primary            100 MB  1024 KB

  Partition 2    Primary            931 GB   101 MB

 

======================================================================================================

 

Disk: 0

Partition 1

Type  : 07

Hidden: No

Active: Yes

 

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info

  ----------  ---  -----------  -----  ----------  -------  ---------  --------

* Volume 2     C   System       NTFS   Partition    100 MB  Healthy            

 

======================================================================================================

 

Disk: 0

Partition 2

Type  : 07

Hidden: No

Active: No

 

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info

  ----------  ---  -----------  -----  ----------  -------  ---------  --------

* Volume 3     D   Windows      NTFS   Partition    931 GB  Healthy            

 

======================================================================================================

 

Partitions of Disk 1:

===============

 

Disk ID: 00000000

 

  Partition ###  Type              Size     Offset

  -------------  ----------------  -------  -------

  Partition 1    Primary           3827 MB    19 KB

 

======================================================================================================

 

Disk: 1

Partition 1

Type  : 0B

Hidden: No

Active: No

 

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info

  ----------  ---  -----------  -----  ----------  -------  ---------  --------

* Volume 4     G   CRUZER       FAT32  Removable   3827 MB  Healthy            

 

======================================================================================================

============================== MBR Partition Table ==================

 

==============================

Partitions of Disk 0:

===============

Disk ID: 32A54498

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

 

==============================

Partitions of Disk 1:

===============

Disk ID: 00000000

 

Partition: GPT Partition Type.

 

 

Windows Boot Manager

--------------------

identifier              {bootmgr}

device                  partition=C:

description             Windows Boot Manager

locale                  en-US

inherit                 {globalsettings}

default                 {default}

resumeobject            {64c07d03-af98-11e3-9214-448a5b6713ec}

displayorder            {default}

toolsdisplayorder       {memdiag}

timeout                 30

 

Windows Boot Loader

-------------------

identifier              {default}

device                  partition=D:

path                    \Windows\system32\winload.exe

description             Windows 7

locale                  en-US

inherit                 {bootloadersettings}

recoverysequence        {current}

recoveryenabled         Yes

osdevice                partition=D:

systemroot              \Windows

resumeobject            {64c07d03-af98-11e3-9214-448a5b6713ec}

nx                      OptIn

 

Windows Boot Loader

-------------------

identifier              {current}

device                  ramdisk=[D:]\Recovery\64c07d05-af98-11e3-9214-448a5b6713ec\Winre.wim,{64c07d06-af98-11e3-9214-448a5b6713ec}

path                    \windows\system32\winload.exe

description             Windows Recovery Environment

inherit                 {bootloadersettings}

osdevice                ramdisk=[D:]\Recovery\64c07d05-af98-11e3-9214-448a5b6713ec\Winre.wim,{64c07d06-af98-11e3-9214-448a5b6713ec}

systemroot              \windows

nx                      OptIn

winpe                   Yes

 

Resume from Hibernate

---------------------

identifier              {64c07d03-af98-11e3-9214-448a5b6713ec}

device                  partition=D:

path                    \Windows\system32\winresume.exe

description             Windows Resume Application

locale                  en-US

inherit                 {resumeloadersettings}

filedevice              partition=D:

filepath                \hiberfil.sys

debugoptionenabled      No

 

Windows Memory Tester

---------------------

identifier              {memdiag}

device                  partition=C:

path                    \boot\memtest.exe

description             Windows Memory Diagnostic

locale                  en-US

inherit                 {globalsettings}

badmemoryaccess         Yes

 

EMS Settings

------------

identifier              {emssettings}

bootems                 Yes

 

Debugger Settings

-----------------

identifier              {dbgsettings}

debugtype               Serial

debugport               1

baudrate                115200

 

RAM Defects

-----------

identifier              {badmemory}

 

Global Settings

---------------

identifier              {globalsettings}

inherit                 {dbgsettings}

                        {emssettings}

                        {badmemory}

 

Boot Loader Settings

--------------------

identifier              {bootloadersettings}

inherit                 {globalsettings}

                        {hypervisorsettings}

 

Hypervisor Settings

-------------------

identifier              {hypervisorsettings}

hypervisordebugtype     Serial

hypervisordebugport     1

hypervisorbaudrate      115200

 

Resume Loader Settings

----------------------

identifier              {resumeloadersettings}

inherit                 {globalsettings}

 

Device options

--------------

identifier              {64c07d06-af98-11e3-9214-448a5b6713ec}

description             Ramdisk Options

ramdisksdidevice        partition=D:

ramdisksdipath          \Recovery\64c07d05-af98-11e3-9214-448a5b6713ec\boot.sdi

 

 

****** End Of Log ****** 

[Dakeyras]

Hi.

Thank you for your continued assistance.

You're welcome, lets proceed as follows shall we...

Custom FRST Script:

Please download the attached fixlist.txt(see below) and save to the same Flash/USB drive that has FRST64 on it.

[attachment=78934:fixlist.txt]

• Now please enter System Recovery Options then select Command Prompt.
• Run FRST64 again as outlined in my prior post and then press the Fix button just once and wait.
• The tool will make a log on the flashdrive (Fixlog.txt). Please copy and paste the contents of the aforementioned notepad file in your next reply.
• Restart your machine and check if it is now able to boot into Normal Mode or not.

[Mr.Monocles]

Contents of the Fixlog

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version:18-10-2015

Ran by SYSTEM (2015-10-22 15:32:40) Run:1

Running from g:\

Boot Mode: Recovery

==============================================

 

fixlist content:

*****************

cmd: bootrec /FixMbr

cmd: bootrec /FixBoot

*****************

 

 

=========  bootrec /FixMbr =========

 

��T h e   o p e r a t i o n   c o m p l e t e d   s u c c e s s f u l l y . 

 

========= End of CMD: =========

 

 

=========  bootrec /FixBoot =========

 

��T h e   o p e r a t i o n   c o m p l e t e d   s u c c e s s f u l l y . 

 

========= End of CMD: =========

 

 

 

 = = = =   E n d   o f   F i x l o g   1 5 : 3 2 : 4 1   = = = =

[Mr.Monocles]

A thought: could it be possible for me to use the farbar recovery tool to determine the files missing from the computer and and insert copied files from my windows 7 home premium laptop into the malfunctioning pc(which is also windows 7 home premium).

[Dakeyras]

Hi.

I take it the machine we have been working on is still unable to boot into Normal Mode, hence your query:

A thought: could it be possible for me to use the farbar recovery tool to determine the files missing from the computer and insert copied files from my windows 7 home premium laptop into the malfunctioning pc(which is also windows 7 home premium).

Actually such is feasible in certain situations but not this one I'm afraid due to this denoted in the FRST log:

ATTENTION: Could not load system hive.
ATTENTION: System hive is missing.

Basically HitmanPro has during its disinfection process(which ill advisedly uses multiple security vendors detection databases simultaneously for scanning/removal etc) has pretty much destroyed the Registry of the machine and other vital component's of the Operating System as a whole most unfortunately.

So sadly at this juncture my best advise would be my prior; a reformat of the hard-drive and reinstallation of the Windows Operating System.

[Mr.Monocles]

Is there any way for me to save that data on the hard drive while reinstalling windows?

[Dakeyras]

Hi.
 

Is there any way for me to save that data on the hard drive while reinstalling windows?

Not quite no in this instance, there is something known as a Repair Install which would leave say documents and pictures intact, overall user data and installed software also etc but I do not think that is a viable option in this scenario otherwise would have advised such.

You could however before carrying out the actual reformat of the hard-drive and reinstallation of the Windows Operating System; attach a Flash/USB drive then boot-up into the System Recovery Options and then select the Command Prompt. Use the aforementioned to navigate around the hard-drive and copy/save anything you locate etc.

The below is worth reading/bookmarking for future reference:

Computer Security - a short guide to staying safer online

Next:

Any questions? Feel free to ask, if not stay safe!